CVE-2017-12733

high-risk

Published 2017-09-09

A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. An attacker may create an application user account to gain administrative privileges.

Do I need to act?

1.2% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (15)

Sitesentinel Isite Atg Firmware

Sitesentinel Integra 100 Firmware

Sitesentinel Isite Atg Firmware

Sitesentinel Integra 500 Firmware

Sitesentinel Integra 100 Firmware

Affected Vendors

Opwglobal

References (4)

Third Party Advisory http://www.securityfocus.com/bid/100563

Mitigation https://ics-cert.us-cert.gov/advisories/ICSA-17-243-04

Third Party Advisory http://www.securityfocus.com/bid/100563

Mitigation https://ics-cert.us-cert.gov/advisories/ICSA-17-243-04

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 4/34 · Minimal

Exposure 18/34 · Moderate